Case C‑129/21

Proximus NV

v

Gegevensbeschermingsautoriteit

(Request for a preliminary ruling from the Hof van beroep te Brussel)

Judgment of the Court (Fourth Chamber) of 27 October 2022

(Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry services – Regulation (EU) 2016/679 – Article 17 – Right to erasure (‘right to be forgotten’) – Article 5(2) – Article 24 – Information obligations and responsibility of the controller)

1. Approximation of laws – Telecommunications sector – Processing of personal data and the protection of privacy in the electronic communications sector – Directive 2002/58 – Undertakings publishing public directories – Consent of the data subject – Concept – Conditions

   (European Parliament and Council Directive 2002/58, recitals 38 and 39 and Arts 1(1) and 12(1) and (3))

   (see paragraphs 41-50)

2. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Directive 2002/58 – Undertakings publishing public directories – Consent – Concept – Conditions

   (European Parliament and Council Regulation 2016/679, Arts 4(11), 6(1)(a), 7(3), 94(2) and 95; European Parliament and Council Directive 2002/58, Arts 2, second subpara., point (f), and 12(2))

   (see paragraphs 51-56, 64, operative part 1)

3. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Scope

   (European Parliament and Council Regulation 2016/679, Arts 94 and 95; European Parliament and Council Directive 2002/58, recital 10)

   (see paragraph 62)

4. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to erasure – Scope – Withdrawal of consent – Request to have personal data withdrawn from directories – Included

   (European Parliament and Council Regulation 2016/679, Arts 6(1)(a), 7(3) and 17(1) (b) and (d))

   (see paragraphs 63, 65-67, 71, operative part 2)

5. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Right to rectification – Scope – Request for withdrawal of a subscriber’s data contained in a directory by the adjustment of the code in the database – Not included

   (European Parliament and Council Regulation 2016/679, Art. 16)

   (see paragraphs 68-70)

6. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Obligations of the controller – Implementation of appropriate technical and organisational measures

   (European Parliament and Council Regulation 2016/679, Arts 5(1)(a) and (2), 6(1)(a), 7(3), 12(2), 17(1), 19 and 24; European Parliament and Council Directive 2002/58, Art. 12(2))

   (see paragraphs 77-86, 89, operative part 3)

7. Protection of natural persons with regard to the processing of personal data – Regulation 2016/679 – Obligations of the controller – Reasonable steps to inform controllers of the request for erasure of data

   (European Parliament and Council Regulation 2016/679, recital 66 and Arts 4(2) and (7) and 17(2))

   (see paragraphs 92-95, 98, operative part 4)

See the text of the decision.